Sign inGet started

    Security & data

    Built so the boring questions get easy answers.

    mailnix runs in German data centres, processes data under EU law, and exposes the customer-side controls (DSAR erasure, key rotation, audit log) you'd expect from any serious infrastructure vendor.

    DATA RESIDENCY

    EU-only by design

    Primary and DR regions are Hetzner DCs in Germany (Nuremberg + Falkenstein). No data leaves EU jurisdiction without a customer opt-in.

    ENCRYPTION

    TLS 1.3 in flight, AES-GCM at rest

    All API and SMTP traffic is TLS 1.3. Provider credentials and CAPTCHA secrets are AES-256-GCM-encrypted at rest under HKDF-derived per-row keys.

    AUTH

    OAuth 2.1 + PKCE S256

    Standard OAuth 2.1 with audience-bound JWTs per surface. Refresh tokens rotate every request; presenting a rotated-out token revokes the chain.

    DSAR

    One call to erase

    DELETE /v1/account/data or the dashboard "Delete all data" button runs the full DSAR cascade across every user-attributed row.

    AUDIT

    Every mutation logged

    Org-scoped audit log records who did what to which target, with an actor-kind classification (user / org / admin / system) and full target detail.

    SECRETS

    Show-once, rotate any time

    HMAC secrets, SMTP passwords, and bearer tokens are shown once on issuance. Hashes are stored with argon2id; lossy preview only after.

    Compliance & legal

    GDPR-compliant. DPA on request.

    LIMERION GmbH operates from Liechtenstein and processes EU customer data under GDPR. A signed Data Processing Agreement is available on request to any Pro or Enterprise customer; the standard SCC template covers cross-border processing where it applies.

    Read the DPA templatePrivacy policyRequest signed copy

    One HTTP call to get started

    Put a form on your site tonight. Wire your provider when you're ready.

    Start freeRead the docs